Non-volatile memory cells are well known in the art. One prior art non-volatile split gate memory cell 10, which contains five terminals, is shown in FIG. 1. Memory cell 10 comprises semiconductor substrate 12 of a first conductivity type, such as P type. Substrate 12 has a surface on which there is formed a first region 14 (also known as the source line SL) of a second conductivity type, such as N type. A second region 16 (also known as the drain line) also of N type is formed on the surface of substrate 12. Between the first region 14 and the second region 16 is channel region 18. Bit line BL 20 is connected to the second region 16. Word line WL 22 is positioned above a first portion of the channel region 18 and is insulated therefrom. Word line 22 has little or no overlap with the second region 16. Floating gate FG 24 is over another portion of channel region 18. Floating gate 24 is insulated therefrom, and is adjacent to word line 22. Floating gate 24 is also adjacent to the first region 14. Floating gate 24 may overlap the first region 14 to provide coupling from the first region 14 into floating gate 24. Coupling gate CG (also known as control gate) 26 is over floating gate 24 and is insulated therefrom. Erase gate EG 28 is over the first region 14 and is adjacent to floating gate 24 and coupling gate 26 and is insulated therefrom. The top corner of floating gate 24 may point toward the inside corner of the T-shaped erase gate 28 to enhance erase efficiency. Erase gate 28 is also insulated from the first region 14. Memory cell 10 is more particularly described in U.S. Pat. No. 7,868,375, whose disclosure is incorporated herein by reference in its entirety.
One exemplary operation for erase and program of prior art non-volatile memory cell 10 is as follows. Memory cell 10 is erased, through a Fowler-Nordheim tunneling mechanism, by applying a high voltage on erase gate 28 with other terminals equal to zero volts. Electrons tunnel from floating gate 24 into erase gate 28 causing floating gate 24 to be positively charged, turning on the cell 10 in a read condition. The resulting cell erased state is known as ‘1’ state.
Memory cell 10 is programmed, through a source side hot electron programming mechanism, by applying a high voltage on coupling gate 26, a high voltage on source line 14, a medium voltage on erase gate 28, and a programming current on bit line 20. A portion of electrons flowing across the gap between word line 22 and floating gate 24 acquire enough energy to inject into floating gate 24 causing the floating gate 24 to be negatively charged, turning off the cell 10 in a read condition. The resulting cell programmed state is known as ‘0’ state.
Memory cell 10 is read in a Current Sensing Mode as following: A bias voltage is applied on bit line 20, a bias voltage is applied on word line 22, a bias voltage is applied on coupling gate 26, a bias or zero voltage is applied on erase gate 28, and a ground is applied on source line 14. There exists a cell current flowing from bit line 20 to source line 14 for an erased state and there is insignificant or zero cell current flow from the bit line 20 to the source line 14 for a programmed state. Alternatively, memory cell 10 can be read in a Reverse Current Sensing Mode, in which bit line 20 is grounded and a bias voltage is applied on source line 24. In this mode the current reverses the direction from source line 14 to bitline 20.
Memory cell 10 alternatively can be read in a Voltage Sensing Mode as following: A bias current (to ground) is applied on bit line 20, a bias voltage is applied on word line 22, a bias voltage is applied on coupling gate 26, a bias voltage is applied on erase gate 28, and a bias voltage is applied on source line 14. There exists a cell output voltage (significantly >0V) on bit line 20 for an erased state and there is insignificant or close to zero output voltage on bit line 20 for a programmed state. Alternatively, memory cell 10 can be read in a Reverse Voltage Sensing Mode, in which bit line 20 is biased at a bias voltage and a bias current (to ground) is applied on source line 14. In this mode, memory cell 10 output voltage is on the source line 14 instead of on the bit line 20.
In the prior art, various combinations of positive or zero voltages were applied to word line 22, coupling gate 26, and floating gate 24 to perform read, program, and erase operations
In response to the read, erase or program command, the logic circuit 451 (in FIG. 4) causes the various voltages to be supplied in a timely and least disturb manner to the various portions of both the selected memory cell 10 and the unselected memory cells 10.
For the selected and unselected memory cell 10, the voltage and current applied are as follows. As used hereinafter, the following abbreviations are used: source line or first region 14 (SL), bit line 20 (BL), word line 22 (WL), and coupling gate 26 (CG).
TABLE NO. 1Operation of Flash Memory Cell 10 Using Positive Voltages for Read, Erase, and ProgramWL-BL-CG -unselCG -EG-WLunselBLunselCGsame sectorunselEGunselRead1.0-2V0 V0.6-2V0 V-FLT0-2.6V0-2.6 V0-2.6 V0-2.6V0-2.6 VErase0V0 V0V0 V0V0-2.6 V0-2.6 V11.5-12V0-2.6 VProgram1V0 V1uAVinh10-11V0-2.6 V0-2.6 V4.5-5V0-2.6 VSLSL-unselRead0V0 V-FLTErase0 VV0 VProgram4.5-5 VV0-1 V/FLT
In a recent application by the applicant—U.S. patent application Ser. No. 14/602,262, filed on Jan. 21, 2015, which is incorporated by reference—the applicant disclosed an invention whereby negative voltages could be applied to word line 22 and/or coupling gate 26 during read, program, and/or erase operations. In this embodiment, the voltage and current applied to the selected and unselected memory cell 10, are as follows.
TABLE NO. 2Operation of Flash Memory Cell 10 Using Negative Voltages for Read and/or ProgramWL -BL -CG -unselCG -EG-WLunselBLunselCGsame sectorunselEGunselRead1.0-2V−0.5 V/0 V0.6-2V0 V-FLT0-2.6V0-2.6 V0-2.6 V0-2.6V0-2.6 VErase0V0 V0V0 V0V0-2.6 V0-2.6 V11.5-12V0-2.6 VProgram1V−0.5 V/0 V1uAVinh10-11V0-2.6 V0-2.6 V4.5-5V0-2.6 VSLSL-unselRead0V0 V-FLTErase0V0 VProgram4.5-5V0-1 V/FLT
In another embodiment of U.S. patent application Ser. No. 14/602,262, negative voltages can be applied to word line 22 when memory cell 10 is unselected during read, erase, and program operations, and negative voltages can be applied to coupling gate 26 during an erase operation, such that the following voltages are applied:
TABLE NO. 3Operation of Flash Memory Cell 10 Using Negative Voltages for EraseWL -BL -CG -unselCG -EG-WLunselBLunselCGsame sectorunselEGunselRead1.0-2V−0.5 V/0 V0.6-2V0-FLT0-2.6V0-2.6 V0-2.6 V0-2.6V0-2.6 VErase0V−0.5 V/0 V0V0-FLT−(5-9)V0-2.6 V0-2.6 V8-9V0-2.6 VProgram1V−0.5 V/0 V1uAVinh8-9VCGINH (4-6 V)0-2.6 V8-9V0-2.6 VSLSL-unselRead0V0-FLTErase0V0 VProgram4.5-5V0-1 V/FLT
The CGINH signal listed above is an inhibit signal that is applied to the coupling gate 26 of an unselected cell that shares an erase gate 28 with a selected cell.
FIG. 2 depicts an embodiment of another prior art flash memory cell 210. As with prior art flash memory cell 10, flash memory cell 210 comprises substrate 12, first region (source line) 14, second region 16, channel region 18, bit line 20, word line 22, floating gate 24, and erase gate 28. Unlike prior art flash memory cell 10, flash memory cell 210 does not contain a coupling gate or control gate and only contains four terminals—bit line 20, word line 22, erase gate 28, and source line 14. This significantly reduces the complexity of the circuitry, such as decoder circuitry, required to operate an array of flash memory cells.
The erase operation (erasing through erase gate) and read operation are similar to that of the FIG. 1 except there is no control gate bias. The programming operation also is done without the control gate bias, hence the program voltage on the source line is higher to compensate for lack of control gate bias.
Table No. 4 depicts typical voltage ranges that can be applied to the four terminals for performing read, erase, and program operations:
TABLE NO. 4Operation of Flash Memory Cell 210WLWL-unselBLBL-unselEGEG-unselSLSL-unselRead0.7-2.2V−0.5 V/0 V 0.6-2V0 V/FLT0-2.6V0-2.6 V0 V0 V/FLT/VBErase−0.5 V/0 V−.5 V/0 V0V0 V11.5V0-2.6 V0 V0 VProgram1-1.5V−.5 V/0 V1-3μAVinh (~1.8 V)4.5V0-2.6 V7-9 V 0-1 V/FLT
FIG. 3 depicts an embodiment of another prior art flash memory cell 310. As with prior art flash memory cell 10, flash memory cell 310 comprises substrate 12, first region (source line) 14, second region 16, channel region 18, bit line 20, and floating gate 24. Unlike prior art flash memory cell 10, flash memory cell 310 does not contain a coupling gate or control gate or an erase gate. In addition, word line 322 replaces word line 22 and has a different physical shape than word line 22, as depicted.
One exemplary operation for erase and program of prior art non-volatile memory cell 310 is as follows. The cell 310 is erased, through a Fowler-Nordheim tunneling mechanism, by applying a high voltage on the word line 322 and zero volts to the bit line and source line. Electrons tunnel from the floating gate 24 into the word line 322 causing the floating gate 24 to be positively charged, turning on the cell 310 in a read condition. The resulting cell erased state is known as ‘1’ state. The cell 310 is programmed, through a source side hot electron programming mechanism, by applying a high voltage on the source line 14, a small voltage on the word line 322, and a programming current on the bit line 320. A portion of electrons flowing across the gap between the word line 322 and the floating gate 24 acquire enough energy to inject into the floating gate 24 causing the floating gate 24 to be negatively charged, turning off the cell 310 in read condition. The resulting cell programmed state is known as ‘0’ state.
Exemplary voltages that can be used for the read, program, erase, and standby operations in memory cell 310 are shown below in Table 5:
TABLE No. 5Operation of Flash Memory Cell 310OperationWLBLSLReadVwlrdVblrd0 VProgramVwlpIprog/Vinh (unsel)VslpEraseVwler0 V0 VStandby0 V0 V0 VVwlrd ~2-3 VVblrd ~0.8-2 VVwlp ~1-2 VVwler ~11-13 VVslp ~9-10 VIprog ~1-3 uaVinh ~2 V
Security and anti-tampering measures are becoming increasingly important as cyber-attackers and hackers become more and more sophisticated. For example, when a mobile phone is stolen, it is common for the thief or someone to whom the phone is sold to attempt to retrieve data from the phone. This can be done by hacking the password to the phone, or by hacking underlying hardware within the phone.
The prior art includes dozens of software-based security measures that can be implemented on the system level (e.g., for the phone). These measures, however, do not prevent someone from disassembling the phone and retrieving data directly from non-volatile storage such as from a flash memory device. To date, the security measures available for flash memory devices have been extremely limited.
What is needed are improved security measures specifically for flash memory devices.